[SECURITY] [DSA 4384-1] libgd2 security update

2019-02-0420:58:09

lists.debian.org

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

JSON

Debian Security Advisory DSA-4384-1 [email protected]
https://www.debian.org/security/ Salvatore Bonaccorso
February 04, 2019 https://www.debian.org/security/faq

Package : libgd2
CVE ID : CVE-2019-6977 CVE-2019-6978
Debian Bug : 920645 920728

Multiple vulnerabilities have been discovered in libgd2, a library for
programmatic graphics creation and manipulation, which may result in
denial of service or potentially the execution of arbitrary code if a
malformed file is processed.

For the stable distribution (stretch), these problems have been fixed in
version 2.2.4-2+deb9u4.

We recommend that you upgrade your libgd2 packages.

For the detailed security status of libgd2 please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/libgd2

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: [email protected]

OSVersionArchitecturePackageVersionFilename
Debian8amd64libgd2-noxpm-dev< 2.1.0-5+deb8u12libgd2-noxpm-dev_2.1.0-5+deb8u12_amd64.deb
Debian8armhfphp5-cli< 5.6.40+dfsg-0+deb8u1php5-cli_5.6.40+dfsg-0+deb8u1_armhf.deb
Debian8i386php5-tidy< 5.6.40+dfsg-0+deb8u1php5-tidy_5.6.40+dfsg-0+deb8u1_i386.deb
Debian9arm64libgd3-dbgsym< 2.2.4-2+deb9u4libgd3-dbgsym_2.2.4-2+deb9u4_arm64.deb
Debian9s390xlibgd3< 2.2.4-2+deb9u4libgd3_2.2.4-2+deb9u4_s390x.deb
Debian8armhfphp5-pgsql< 5.6.40+dfsg-0+deb8u1php5-pgsql_5.6.40+dfsg-0+deb8u1_armhf.deb
Debian9i386libgd-tools< 2.2.4-2+deb9u4libgd-tools_2.2.4-2+deb9u4_i386.deb
Debian9ppc64ellibgd-tools-dbgsym< 2.2.4-2+deb9u4libgd-tools-dbgsym_2.2.4-2+deb9u4_ppc64el.deb
Debian8i386php5-sqlite< 5.6.40+dfsg-0+deb8u1php5-sqlite_5.6.40+dfsg-0+deb8u1_i386.deb
Debian8armhflibgd2-noxpm-dev< 2.1.0-5+deb8u12libgd2-noxpm-dev_2.1.0-5+deb8u12_armhf.deb

OS	Version	Architecture	Package	Version	Filename
Debian	8	amd64	libgd2-noxpm-dev	< 2.1.0-5+deb8u12	libgd2-noxpm-dev_2.1.0-5+deb8u12_amd64.deb
Debian	8	armhf	php5-cli	< 5.6.40+dfsg-0+deb8u1	php5-cli_5.6.40+dfsg-0+deb8u1_armhf.deb
Debian	8	i386	php5-tidy	< 5.6.40+dfsg-0+deb8u1	php5-tidy_5.6.40+dfsg-0+deb8u1_i386.deb
Debian	9	arm64	libgd3-dbgsym	< 2.2.4-2+deb9u4	libgd3-dbgsym_2.2.4-2+deb9u4_arm64.deb
Debian	9	s390x	libgd3	< 2.2.4-2+deb9u4	libgd3_2.2.4-2+deb9u4_s390x.deb
Debian	8	armhf	php5-pgsql	< 5.6.40+dfsg-0+deb8u1	php5-pgsql_5.6.40+dfsg-0+deb8u1_armhf.deb
Debian	9	i386	libgd-tools	< 2.2.4-2+deb9u4	libgd-tools_2.2.4-2+deb9u4_i386.deb
Debian	9	ppc64el	libgd-tools-dbgsym	< 2.2.4-2+deb9u4	libgd-tools-dbgsym_2.2.4-2+deb9u4_ppc64el.deb
Debian	8	i386	php5-sqlite	< 5.6.40+dfsg-0+deb8u1	php5-sqlite_5.6.40+dfsg-0+deb8u1_i386.deb
Debian	8	armhf	libgd2-noxpm-dev	< 2.1.0-5+deb8u12	libgd2-noxpm-dev_2.1.0-5+deb8u12_armhf.deb